SC-200 Incident Response & Remediation 2

Question 1

During a ransomware incident, a security analyst needs to isolate a compromised Windows device from the network while preserving the ability to manage it remotely via Microsoft Defender for Endpoint. Which action should be taken?

Accepted Answer

Contain the device using the Isolate Device action in the MDE portal

Answer

The Isolate Device action in Microsoft Defender for Endpoint blocks all network traffic except the MDE management channel, enabling continued remote investigation.

Question 2

A SOC analyst is investigating an alert triggered by Microsoft Sentinel indicating a suspicious process injection. Which KQL query clause would filter ProcessCreationEvents to show only events where a child process spawned from an unexpected parent?

Accepted Answer

where InitiatingProcessFileName !in ('explorer.exe', 'svchost.exe') and FileName == 'powershell.exe'

Answer

Filtering by unexpected parent processes (InitiatingProcessFileName) helps surface process injection and living-off-the-land techniques.

Question 3

After containing a compromised endpoint, an analyst must determine the scope of lateral movement. Which Microsoft Defender for Endpoint feature provides a visual timeline of all machine interactions and network connections for a specific device?

Accepted Answer

Device Timeline

Answer

The Device Timeline in MDE shows a chronological record of events, alerts, and network connections for an endpoint, aiding scope determination.

Question 4

An organization wants to automatically trigger an isolation playbook in Microsoft Sentinel when a high-severity alert involving a specific host is generated. What should the analyst configure?

Accepted Answer

An analytics rule with an automation rule that runs a playbook

Answer

Analytics rules detect threats and automation rules can trigger Logic Apps (playbooks) based on incident conditions such as severity and entity type.

Question 5

A threat actor used Pass-the-Hash to move laterally across several Windows servers. Which remediation step is MOST effective at preventing reuse of the stolen NTLM hash?

Accepted Answer

Reset the compromised account password and invalidate existing sessions

Answer

Resetting the password invalidates the existing NTLM hash, preventing its reuse in future Pass-the-Hash attacks.

(SC-200) Microsoft Security Operations Analyst Practice Test

(SC-200) Microsoft Security Operations Analyst Practice Test

SC-200 Incident Response & Remediation 2